rules-hub-windows-x86_64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
rules-hub-windows-x86_64.exe
Size 4.0MB
Sample261102-2rdgtaxthv
SHA256 31e1e6115f6fce560a4537aeb713923d054320e1877fbf07f04b1d35b9669784
MD5 83e59468214187b57346bec339d6d1a3
SHA1 8c853d9efcb85881b8af554325ac6e446c9db607
SHA512 c97d90da0d12533f85288fdc6107d85015bfdadd1c4ec59c0ffaf5523dd65b024b16851bd43e453b4707f6994392d082cb069477a0548adf95e9755a88b887e4
SSDEEP 49152:W894WUC+0aaMOkuuXiRNY9aL8FOCQSBv1J20EnsyrlW9H6DI/s5/wvVvH6kspxvw:W8oRyRNY9alaaf
TLSH
T17F1619603A5A98BCD58AC470934A46B35E2130DB1B2AB9FF44C496783F79AF52F3D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rules-hub-windows-x86_64.exe

File Explorer

rules-hub-windows-x86_64.exe

.exe 4.0MB

rules-hub-windows-x86_64.exe

IMPHASH 95f054d1ed9aaa088bc9592775ecfc3e
SHA256 31e1e6115f6fce560a4537aeb713923d054320e1877fbf07f04b1d35b9669784
MD5 83e59468214187b57346bec339d6d1a3
SHA1 8c853d9efcb85881b8af554325ac6e446c9db607
SHA512 c97d90da0d12533f85288fdc6107d85015bfdadd1c4ec59c0ffaf5523dd65b024b16851bd43e453b4707f6994392d082cb069477a0548adf95e9755a88b887e4
SSDEEP 49152:W894WUC+0aaMOkuuXiRNY9aL8FOCQSBv1J20EnsyrlW9H6DI/s5/wvVvH6kspxvw:W8oRyRNY9alaaf
TLSH
T17F1619603A5A98BCD58AC470934A46B35E2130DB1B2AB9FF44C496783F79AF52F3D314
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2799296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rules_hub.pdb

bcryptprimitives

ProcessPrng

kernel32

CopyFileExW WaitForSingleObject GetFullPathNameW ReadFile CreateEventW GetOverlappedResult SetLastError WriteFileEx ReadFileEx SleepEx SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess WaitForMultipleObjects CreateDirectoryW SetThreadStackGuarantee GetCurrentThread RemoveDirectoryW FlushFileBuffers FindFirstFileExW ExitProcess GetSystemInfo CreateMutexA ReleaseMutex GetFinalPathNameByHandleW DeleteFileW ReadConsoleW WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW FlsFree FlsAlloc IsThreadAFiber FlsSetValue GetFileType ReleaseSemaphore ReadDirectoryChangesW CreateFileW FindNextFileW SetConsoleCtrlHandler RegisterWaitForSingleObject UnregisterWaitEx CancelIo WaitForSingleObjectEx CreateSemaphoreW SetFileCompletionNotificationModes GetProcessHeap HeapFree HeapReAlloc FreeEnvironmentStringsW GetEnvironmentStringsW CompareStringOrdinal QueryPerformanceCounter AddVectoredExceptionHandler GetCurrentDirectoryW GetCommandLineW lstrlenW GetProcAddress WideCharToMultiByte LoadLibraryA GetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar GetModuleHandleExW GetModuleHandleW FormatMessageW GetModuleHandleA QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetQueuedCompletionStatusEx CreateIoCompletionPort GetSystemTimePreciseAsFileTime PostQueuedCompletionStatus SetHandleInformation GetStdHandle TerminateProcess GetSystemTimeAsFileTime CreateThread SwitchToThread GetCurrentProcessId GetLastError DuplicateHandle GetCurrentProcess SetUnhandledExceptionFilter FindClose CloseHandle GetCurrentThreadId MoveFileExW InitializeSListHead

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

ws2_32

getaddrinfo shutdown setsockopt send getsockname recv WSAStartup WSAIoctl freeaddrinfo WSASend accept connect listen bind ioctlsocket WSASocketW WSAGetLastError getsockopt closesocket

ntdll

RtlNtStatusToDosError NtCancelIoFileEx NtDeviceIoControlFile NtOpenFile NtCreateFile NtCreateNamedPipeFile NtReadFile NtWriteFile

vcruntime140

memcmp _CxxThrowException __C_specific_handler memcpy __current_exception __CxxFrameHandler3 memmove memset __current_exception_context

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-math-l1-1-0

pow __setusermatherr

api-ms-win-crt-runtime-l1-1-0

exit _initterm_e terminate _crt_atexit _initterm _configure_narrow_argv _initialize_narrow_environment _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _initialize_onexit_table _cexit _register_onexit_function _seh_filter_exe _set_app_type _exit _get_initial_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free